search

SpinaCMS / Spina

Spina CMS
http://www.spinacms.com
Other
2.2k stars 408 forks source link

Fix for CVE-2024-7106 - Cross-Site Request Forgery? #1381

Closed barrywoolgar closed 1 week ago

barrywoolgar commented 2 months ago

Hello

Is there a fix available (or planned) for CVE-2024-7106?

A vulnerability classified as problematic was found in Spina CMS 2.18.0. Affected by this vulnerability is an unknown functionality of the file /admin/media_folders. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272431. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

At the moment Bundler Audit is recommending we "remove or disable this gem until a patch is available", which isn't much of a long-term solution!

Many thanks

Bramjetten commented 2 months ago

No.

The "bug" they submitted is only tested on the live demo website and is caused by the live demo not having any authentication or authorization. Which is of course purposefully disabled for demo purposes...

This is not present in the Spina gem and has nothing to do with it. I've been unable to have this CVE removed. I have also never been contacted by the individual that published this CVE. It's a scam sadly.

I'm planning on re-adding password authentication to our live demo site and releasing a new version of the Spina gem just to clear this up.

barrywoolgar commented 2 months ago

Thank you for the rapid response, and the context missing from the official CVE pages.

We use automated tooling to make sure we're addressing vulnerabilities (real or imagined!) so it is great to hear that there's a straightforward solution to this.

Please could this issue stay open until the new version is released?

Bramjetten commented 2 months ago

Agreed!

stale[bot] commented 3 weeks ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

barrywoolgar commented 1 week ago

Please can this be re-opened until the CVE is resolved?

Bramjetten commented 1 week ago

This CVE does not apply to the Spina gem, it's garbage. I don't know how to prevent someone from submitting this.

barrywoolgar commented 1 week ago

I totally agree with your earlier assessment, but you also proposed a simple workaround:

Many thanks!

Bramjetten commented 1 week ago

I deleted the live demo and opened a PR for v2.19: https://github.com/SpinaCMS/Spina/pull/1394